Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
10
4
2
Contributors
4
3
3
2
2
Categories
9
7
1
1
1
Platforms
12
2
2
1
1
Products / Services
6
2
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
This rule detects the use of the 'powercfg.exe' utility by non-system accounts to modify power settings, such as disabling hibernation, modifying standby/sleep timeouts, or changing monitor/disk timeout configurations. Such actions can be indicative of attempts to maintain system availability, prevent the system from entering a low-power state that might terminate malicious processes, or ensure persistent execution of unauthorized activities.
This rule detects the use of the 'powercfg.exe' utility by non-system accounts to modify power settings, such as disabling hibernation, modifying standby/sleep timeouts, or changing monitor/disk timeout configurations. Such actions can be indicative of attempts to maintain system availability, prevent the system from entering a low-power state that might terminate malicious processes, or ensure persistent execution of unauthorized activities.
This rule detects the use of the 'powercfg.exe' utility by non-system accounts to modify power settings, such as disabling hibernation, modifying standby/sleep timeouts, or changing monitor/disk timeout configurations. Such actions can be indicative of attempts to maintain system availability, prevent the system from entering a low-power state that might terminate malicious processes, or ensure persistent execution of unauthorized activities.
Detects the execution of powercfg.exe to modify standby timeouts. Attackers may disable sleep modes to ensure continuous execution of malicious payloads, such as credential loggers, and maintain uninterrupted remote access.
Detects modification of power settings to keep system awake for malware
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive strings "powercfg" and "change". This combination suggests an attempt to modify system power settings, potentially to prevent a system from sleeping or shutting down, which could be a persistence mechanism.
This rule detects attempts to change the power plan on a system via a remote web shell. It specifically looks for HTTP requests containing 'powercfg' and 'setactive' in the URI, indicating the use of the 'powercfg /setactive' command, which is used to change the active power scheme. This activity suggests an attacker might be trying to manipulate system power settings, potentially for persistence or to interfere with system operations.
Detects registry modifications that disable or change features of internal Windows tools, often used by malware for defense evasion or persistence. This includes disabling command prompt, control panel, run dialog, task manager, user account control (UAC) prompts, write protection, and notification center.
Detects the use of `systemctl mask` to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.
This hunting query detects adversaries attempting to impair or disable power-related functions in Windows environments. It covers explicit powercfg.exe commands, registry tampering of HibernateEnabled, deletion/modification of the hiberfil.sys file, and suspicious PowerShell usage. Such activity is often leveraged by attackers to maintain persistence or disrupt forensic evidence.
KQL Query from file: Data Exfiltration via Microsoft Teams
KQL Query from file: Detecting Copilot Studio Bot Creation
This query was originally published in the threat analytics report, ironSource PUA & unwanted apps impact millions.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
This rule detects suspicious execution of 'Powercfg.exe' to modify power settings related to the lock screen timeout. Adversaries may use this technique to prevent a system from entering a dormant state, thereby maintaining access and hindering defensive mechanisms. The rule specifically looks for command-line arguments that change the AC (alternating current) or DC (direct current) standby timeout, or modify the video display timeout when the system is locked.